From f0d24e19022bfa32bccc353e43e9a15c9ef7f98c Mon Sep 17 00:00:00 2001 From: Przemyslaw Klys Date: Sun, 27 Dec 2020 22:38:05 +0100 Subject: [PATCH] Update --- Private/Get-GPOPrivInheritance.ps1 | 39 +++++++++++ Private/Get-GPOPrivInheritanceLoop.ps1 | 92 ++++++++++++++++++++++++++ Private/Get-GPOPrivLink.ps1 | 38 +++++++++++ 3 files changed, 169 insertions(+) create mode 100644 Private/Get-GPOPrivInheritance.ps1 create mode 100644 Private/Get-GPOPrivInheritanceLoop.ps1 create mode 100644 Private/Get-GPOPrivLink.ps1 diff --git a/Private/Get-GPOPrivInheritance.ps1 b/Private/Get-GPOPrivInheritance.ps1 new file mode 100644 index 0000000..87130d1 --- /dev/null +++ b/Private/Get-GPOPrivInheritance.ps1 @@ -0,0 +1,39 @@ +function Get-GPOPrivInheritance { + [cmdletBinding()] + param( + [parameter(ParameterSetName = 'ADObject', ValueFromPipeline, ValueFromPipelineByPropertyName, Mandatory)][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject, + [System.Collections.IDictionary] $CacheReturnedGPOs, + [System.Collections.IDictionary] $ForestInformation, + [string] $Domain, + [switch] $SkipDomainRoot, + [switch] $SkipDomainControllers + ) + foreach ($Object in $ADObject) { + if ($SkipDomainRoot) { + if ($Object.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']) { + # other skips Domain Root + continue + } + } + if ($SkipDomainControllers) { + if ($Object.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DomainControllersContainer']) { + # other skips Domain Controllers + continue + } + } + $Inheritance = Get-GPInheritance -Target $Object.DistinguishedName + foreach ($Link in $Inheritance.GpoLinks) { + [PSCustomObject] @{ + DisplayName = $Link.DisplayName + DomainName = $Domain + GUID = $Link.GPOID + Enabled = $Link.Enabled + Enforced = $Link.Enforced + Order = $Link.Order + Target = $Object.DistinguishedName + TargetCanonical = $Object.CanonicalName + TargetObjectClass = $Object.objectClass + } + } + } +} \ No newline at end of file diff --git a/Private/Get-GPOPrivInheritanceLoop.ps1 b/Private/Get-GPOPrivInheritanceLoop.ps1 new file mode 100644 index 0000000..d0fd7e3 --- /dev/null +++ b/Private/Get-GPOPrivInheritanceLoop.ps1 @@ -0,0 +1,92 @@ +function Get-GPOPrivInheritanceLoop { + [cmdletBinding()] + param( + [Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject, + [System.Collections.IDictionary] $CacheReturnedGPOs, + [System.Collections.IDictionary] $ForestInformation, + [validateset('Root', 'DomainControllers', 'Other')][string[]] $Linked, + [string] $SearchBase, + [Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope, + [string] $Filter + ) + if (-not $ADObject) { + if ($Linked) { + foreach ($Domain in $ForestInformation.Domains) { + $Splat = @{ + #Filter = $Filter + Properties = 'distinguishedName', 'gplink', 'CanonicalName' + # Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')" + Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0] + } + if ($Linked -contains 'DomainControllers') { + $SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DomainControllersContainer'] + $Splat['Filter'] = "(objectClass -eq 'organizationalUnit')" + $Splat['SearchBase'] = $SearchBase + try { + $ADObjectGPO = Get-ADObject @Splat + } catch { + Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)" + } + Get-GPOPrivInheritance -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation + } + if ($Linked -contains 'Root') { + $SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName'] + $Splat['Filter'] = "objectClass -eq 'domainDNS'" + $Splat['SearchBase'] = $SearchBase + try { + $ADObjectGPO = Get-ADObject @Splat + } catch { + Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)" + } + Get-GPOPrivInheritance -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation + } + if ($Linked -contains 'Site') { + # Sites are defined only in primary domain + # Sites are not supported by Get-GPInheritance + } + if ($Linked -contains 'Other') { + $SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName'] + $Splat['Filter'] = "(objectClass -eq 'organizationalUnit')" + $Splat['SearchBase'] = $SearchBase + try { + $ADObjectGPO = Get-ADObject @Splat + } catch { + Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)" + } + Get-GPOPrivInheritance -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -SkipDomainRoot -SkipDomainControllers + } + } + } elseif ($Filter) { + foreach ($Domain in $ForestInformation.Domains) { + $Splat = @{ + Filter = $Filter + Properties = 'distinguishedName', 'gplink', 'CanonicalName' + Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0] + + } + if ($PSBoundParameters.ContainsKey('SearchBase')) { + $DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName'] + $SearchBaseDC = ConvertFrom-DistinguishedName -DistinguishedName $SearchBase -ToDC + if ($SearchBaseDC -ne $DomainDistinguishedName) { + # we check if SearchBase is part of domain distinugishname. If it isn't we skip + continue + } + $Splat['SearchBase'] = $SearchBase + + } + if ($PSBoundParameters.ContainsKey('SearchScope')) { + $Splat['SearchScope'] = $SearchScope + } + + try { + $ADObjectGPO = Get-ADObject @Splat + } catch { + Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)" + } + Get-GPOPrivInheritance -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation + } + } + } else { + Get-GPOPrivInheritance -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObject -Domain '' -ForestInformation $ForestInformation + } +} \ No newline at end of file diff --git a/Private/Get-GPOPrivLink.ps1 b/Private/Get-GPOPrivLink.ps1 new file mode 100644 index 0000000..e5f492b --- /dev/null +++ b/Private/Get-GPOPrivLink.ps1 @@ -0,0 +1,38 @@ +function Get-GPOPrivLink { + [cmdletBinding()] + param( + [parameter(ParameterSetName = 'ADObject', ValueFromPipeline, ValueFromPipelineByPropertyName, Mandatory)][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject, + [System.Collections.IDictionary] $CacheReturnedGPOs, + [System.Collections.IDictionary] $ForestInformation, + [string] $Domain, + [switch] $SkipDomainRoot, + [switch] $SkipDomainControllers, + [switch] $AsHashTable + ) + foreach ($Object in $ADObject) { + if ($SkipDomainRoot) { + if ($Object.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']) { + # other skips Domain Root + continue + } + } + if ($SkipDomainControllers) { + if ($Object.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DomainControllersContainer']) { + # other skips Domain Controllers + continue + } + } + $OutputGPOs = Get-PrivGPOZaurrLink -Object $Object -Limited:$Limited.IsPresent -GPOCache $GPOCache + foreach ($OutputGPO in $OutputGPOs) { + if (-not $SkipDuplicates) { + $OutputGPO + } else { + $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid) + if (-not $CacheReturnedGPOs[$UniqueGuid]) { + $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO + $OutputGPO + } + } + } + } +} \ No newline at end of file